Managing variables and secrets

Variables and secrets of stores that don't use WebOps are handled through the VTEX IO CLI secrets plugin. To enable secret management, you need to have an empty vtex.env file in the project root. The key-value pairs are stored in the secrets.revealed.json file, which is then encrypted into secrets.hidden.json before being committed to the main branch. For stores using WebOps, this workflow has been deprecated, and variables and secrets are managed directly through the WebOps interface.

The permissions system is in open beta. To enable it, open a ticket with VTEX Support.

• Product: FastStore
• Category: Secrets
• Resources: View Secrets and Edit Secrets

After you create, update, or delete a variable or secret, it may take a few minutes for the change to propagate. Wait 5 minutes before triggering a new deployment.

If you deployed your storefront immediately after creating, updating, or deleting a variable or secret and the change isn't reflected in your store, wait a few minutes and run another deployment before opening a support ticket.

1. In the Type field, click Select... to open the dropdown menu, then choose text for non-sensitive values that can be viewed later (for example, public URLs), or secret for sensitive values that must be hidden after saving (for example, API tokens and passwords).
2. In the Key field, enter the name of the variable or secret, which serves as its unique identifier (for example, VTEX_API_TOKEN, NEXT_SECRET_KEY).

Variables accessible in the browser (client-side) must start with the prefix NEXT_PUBLIC_. Use names without this prefix for all other variables and secrets.

3. In the Value field, enter the corresponding information you want to store (for example, the actual token, key, or password).
4. Click Add. A pop-up with New secret added successfully will open, and you'll see the message Variables have changed. Changes will take effect in the next successful deployment. alongside a Redeploy button.

When creating multiple variables and secrets, make sure you include all of them before proceeding to the next step. This prevents sync errors.

5. Wait 5 minutes, then click Redeploy to redeploy your website with the updated variable and secret configuration. You'll see the message Redeploying with secret changes, and a pop-up with Deployment created successfully will open.
6. Track the deployment status in the Deploys tab of the WebOps dashboard.

The automatic conversion of variables and secrets into environment variables doesn't apply to the NPM_RC secret, which is handled differently by the build pipeline. See Using a private npm registry for details.

1. Follow the steps in Creating variables and secrets to create a new secret.
2. In the Type field, select secret.
3. In the Key field, enter exactly NPM_RC.
4. In the Value field, enter the entire content you would include in an .npmrc file, with the authentication token written inline. For example:
   
   

   _10

   //npm.pkg.github.com/:_authToken=<YOUR_TOKEN>

   _10

   @your-scope:registry=https://npm.pkg.github.com/

   
   
5. Click Add.
6. Wait 5 minutes, then click Redeploy as described in Creating variables and secrets.

The NPM_RC secret is a special case. During the build, its content is written directly to an .npmrc file before dependencies are installed, so private packages can be resolved. Keep the following in mind:

• Don't reference another variable or secret inside the NPM_RC value (for example, ${TOKEN}). Use the token inline, since the .npmrc file is generated before other variables and secrets are available as environment variables.
• Don't commit an .npmrc file to your project repository. If you need one, provide its content exclusively through the NPM_RC secret.

1. Go to the Current Keys section.
2. Next to the variable or secret you need to update, click ⋮ and then click Edit.
3. Click Update. A pop-up with Secret updated successfully will open, and you'll see the message Variables have changed. Changes will take effect in the next successful deployment. alongside a Redeploy button.
4. Wait 5 minutes, then click Redeploy to redeploy your website with the updated variable and secret configuration. You'll see the message Redeploying with secret changes, and a pop-up with Deployment created successfully will open.
5. Track the deployment status in the Deploys tab of the WebOps dashboard.

1. Go to the Current Keys section.
2. Next to the variable or secret you need to delete, click ⋮ and then click Delete.
3. Confirm the variable or secret you want to delete.

This action can't be undone.

4. Click Delete secret. A pop-up with Secret deleted successfully will open, and you'll see the message Variables have changed. Changes will take effect in the next successful deployment. alongside a Redeploy button.
5. Wait 5 minutes, then click Redeploy to redeploy your website with the updated variable and secret configuration. You'll see the message Redeploying with secret changes, and a pop-up with Deployment created successfully will open.
6. Track the deployment status in the Deploys tab of the WebOps dashboard.

If an error appears (Failed to create/update/delete secret. Please, try again.) when creating, updating, or deleting a variable or secret, repeat the process. If the problem persists, open a ticket with VTEX Support.